Splunk Dev

Content management page does not load / results in a blank page

bohanlon_splunk
Splunk Employee
Splunk Employee

Symptoms = My Content management page does not load / results in a blank page.
Recent changes = Following upgrade of Splunk Core from Splunk=6.3.x to Splunk=6.4.4, and while running Enterprise security ES=4.0.1.
What I've tried already = Upgrading to ES=4.0.5 as per supported platforms documentation here;
http://docs.splunk.com/Documentation/ES/4.0.1/RN/Enhancements

0 Karma
1 Solution

bohanlon_splunk
Splunk Employee
Splunk Employee

As per: https://answers.splunk.com/answers/474850/splunk-enterprise-security-how-to-resolve-error138.html

Present in ES=4.0.1-4.0.5 (Maybe other versions also).
Fixed in Newer versions (i.e. ES=4.2+ ES=4.5+).
Examples of Bug = Splunk Bug references SOLNESS-6255 and SOLNESS-11038.

The cause = The correlation_search.py web controller loads some helper code. This uses relative pathing, so depending on how the controller is executed we might not specify the intended directory.

The workaround:
Edit $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/controllers/correlation_searches.py:

from = sys.path.append( os.path.join("..", "..", "bin") )
to = sys.path.append(make_splunkhome_path(['etc', 'apps', 'SA-ThreatIntelligence', 'bin']))

The Fix:
Upgrade to ES=4.2+ or ES=4.5+

View solution in original post

0 Karma

bohanlon_splunk
Splunk Employee
Splunk Employee

As per: https://answers.splunk.com/answers/474850/splunk-enterprise-security-how-to-resolve-error138.html

Present in ES=4.0.1-4.0.5 (Maybe other versions also).
Fixed in Newer versions (i.e. ES=4.2+ ES=4.5+).
Examples of Bug = Splunk Bug references SOLNESS-6255 and SOLNESS-11038.

The cause = The correlation_search.py web controller loads some helper code. This uses relative pathing, so depending on how the controller is executed we might not specify the intended directory.

The workaround:
Edit $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/controllers/correlation_searches.py:

from = sys.path.append( os.path.join("..", "..", "bin") )
to = sys.path.append(make_splunkhome_path(['etc', 'apps', 'SA-ThreatIntelligence', 'bin']))

The Fix:
Upgrade to ES=4.2+ or ES=4.5+

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...